CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- microsoft hevc video extensionsHEVC Video Extensions Remote Code Execution Vulnerability7.8 High
- microsoft hevc video extensionsHEVC Video Extensions Remote Code Execution Vulnerability7.8 High
- microsoft windows 7, windows 7 service pack 1, windows 8.1 +8 more +10 moreWindows Media Center Elevation of Privilege Vulnerability7.8 High
aspnetcore-runtime-5.0AlmaLinux,aspnetcore-targeting-pack-5.0AlmaLinux,dotnet-apphost-pack-5.0AlmaLinux +6 more +8 more.NET 5.0 bugfix updateNo score- yetiforcecompany yetiforcecompany/yetiforcecrm, yetiforce customer relationship management +1 moreCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm6.6 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreSpecific replication command with malformed oplog entries can crash secondaries6.5 Medium
- yetiforcecompany yetiforcecompany/yetiforcecrm, yetiforce customer relationship management +1 moreBusiness Logic Errors in yetiforcecompany/yetiforcecrm7.3 High
- hd-network real-time monitoring system project real-time monitoring systemHD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via...7.5 High
- ivanti workspace controlIvanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.7.5 High
- irfanviewIrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W...7.8 High
- genesys workforce managementA cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur ...6.1 Medium
- verint workforce optimizationVerint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications...6.1 Medium
- motorola t008 firmware, t100 firmware, t101 firmware +7 more +9 moreCertain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200...4.8 Medium
- securitashome alarm system firmwareAn RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2...6.8 Medium
- securitashome alarm system firmwareThe absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home...5.3 Medium
- clementine-player clementineClementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation,...7.8 High
- clementine-player clementineClementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read...7.8 High
- opencatsOpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an...9.8 Critical
- dolibarrDolibarr Cross Site Scripting (XSS) vulnerability5.4 Medium
- zzcmsA SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask...9.8 Critical
- automoxAutomox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.7.8 High
- automoxAutomox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this...7.8 High
- sofico miles rich internet applicationSofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An...5.4 Medium
- crocoblock jetengineCrocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.9.8 Critical
- socomec remote view pro firmwareAn issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into...5.4 Medium
- socomec remote view pro firmwareAn issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An...8.8 High
- mruby, mruby mruby/mruby +1 moreNULL Pointer Dereference in mruby/mruby9.1 Critical
ghostscriptOSS-FuzzHeap-buffer-overflow in chunk_obj_allocNo scoreghostscriptOSS-FuzzHeap-use-after-free in stellNo scoreflatbuffersOSS-FuzzHeap-buffer-overflow in flexbuffers::Verifier::VerifyRefNo score- mediawikiAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37...5.3 Medium
- mediawikiAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37...7.5 High
- mediawikiAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37...6.5 Medium
- itextpdf itext, debian linux +1 moreCommand injection in itext7-core9.8 Critical
- discourse discourse-footnote, footnote +1 moreInline footnotes wrapped in <a> tags can cause errors in discourse-footnotes4.3 Medium
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreOpenZeppelin Contracts initializer reentrancy may lead to double initialization5.6 Medium
- openzeppelinImproper Initialization in OpenZeppelin7.5 High
com.splunk.logging:splunk-library-javaloggingMavenRemote code injection in Log4jNo score- apereo opencastOpencast publishes global system account credentials7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreactionpack Open Redirect in Host Authorization Middleware6.1 Medium
org.opencastproject:opencast-commonMavenApache Log4j Remote Code ExecutionNo score- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreCross-site Scripting (XSS) - Stored in snipe/snipe-it6.4 Medium
- glfusionglFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ...4.3 Medium
- owncastUnsafe inline XSS Owncast8.2 High
- keybase, zoom video communications inc keybase client for windows +1 moreArbitrary command execution in Keybase Client for Windows5.3 Medium
- zoom meetings, zoom video communications inc client for meetings for android, client for meetings for ios +3 more +5 moreServer Side Request Forgery in Zoom Client for Meetings chat4.7 Medium
- patrowl patrowlmanagerUnrestricted Upload of Files in Patrowl7.4 High
- openprojectSQL injection in OpenProject7.4 High
- patrowl patrowlmanagerImproper Privilege Management in Patrowl7.5 High
- tibco spotfire serverTIBCO Spotfire Server API Authorization Vulnerability7.1 High
- Show moreLoading…